Privacy Policy

What we collect

• Account data: name, email address, organisation, role and billing details.
• Usage data: when a document is opened and by whom, sign-ins, and the actions that go into the audit log.
• Content: quotes, agreements and signatures; customers, service addresses, schedules, work orders and time records; invoices, payments and the basis for ROT and RUT.
• Signing evidence: the signer's IP address, user agent and timestamps, recorded to make a signature provable.

Position data in the field app

A coordinate is recorded at the moment somebody taps to clock in or out, and only if the device returns a reading. There is no background tracking and no automatic clock-in — an iOS progressive web app has no background geolocation, and we do not claim otherwise. Where no reading was returned, that is what is stored: within_geofence is null rather than false, so an absent reading is never recorded as somebody being somewhere they were not.

What we do with it

We process data to provide the Service, to communicate with you, and to improve the product. We never sell your data, and we never use buyer-side or employee-side analytics for profiling across customers.

Visitor statistics on closepact.com

The closepact.com website, not the app, measures visits with Plausible Analytics. According to Plausible's data policy it records the page address (host and path), where the visitor came from and any campaign parameters, the browser, operating system and device type, the country, region and city but never an exact location, how far a page is read and for how long, and pageviews and certain events on the page, such as a click on a button. The IP address and the browser string are used to work out a daily identifier with a salt that is rotated and deleted every 24 hours; the IP address and the browser string themselves are never stored. Plausible sets no cookies and writes nothing to the browser's storage, and the data is processed and stored in the EU. More in Plausible's data policy.

Sub-processors

Hosting, email, coordinates for service addresses and — where they are configured — payment, AI generation and SMS. Each one is listed with its purpose and processing region at /legal/subprocessors, which is the current list. We notify customers in writing at least 30 days before a new one begins processing.

Your rights (GDPR)

You may request access to your data, correction, export, deletion, or the withdrawal of consent, at any time. Write to us at privacy@closepact.com, and we answer within 30 days.

Retention and deletion

Cancelling a module deletes nothing: the paid period runs out, the module stays readable for 90 days, and is then archived — archiving closes access without erasing content. Deleting a user account is requested in the Service with the account password, scheduled 14 days ahead, and can be withdrawn at any time within those 14 days. Audit records are kept for the retention period your organisation sets in Settings → Security: 365 days by default, 30 at the least and 3 650 at the most, after which they are removed — including for organisations that have already left.